ssh 到路由，找到Main_WStatus_Content.asp，发现这一段是动态生成的:
<% nvram_dump("wlan11b.log",""); %>
关键是nvram_dump，在github https://github.com/hiboyhiboy/rt-n56u/ 上全文搜索源码，发现来源是rt-n56u/trunk/user/httpd/web_ex.c
struct ej_handler ej_handlers[] =
{
{ "nvram_get_x", ej_nvram_get_x},
{ "nvram_get_list_x", ej_nvram_get_list_x},
{ "nvram_get_buf_x", ej_nvram_get_buf_x},
{ "nvram_get_table_x", ej_nvram_get_table_x},
{ "nvram_match_x", ej_nvram_match_x},
{ "nvram_double_match_x", ej_nvram_double_match_x},
{ "nvram_match_both_x", ej_nvram_match_both_x},
{ "nvram_match_list_x", ej_nvram_match_list_x},
{ "uptime", ej_uptime},
{ "nvram_dump", ej_dump},
......
没办法，只能构建一个asp文件来获取这些信息
<!-- 5GStatus.asp -->
<% nvram_dump("wlan11b.log",""); %>
然后配合脚本 curl 127.0.0.1/custom/5GStatus.asp